Get-SecureScoreData Error about microsoft-defender-for-cloud

[famjunxiang]

Hi @TomJanetscheck thank you so much for the update, the logic app run without any error now.

[TomJanetscheck]

Hi @famjunxiang ,
thanks for reporting this issue. We're currently working on adding a condition so only enabled subscriptions will be used for getting Secure Score data in the future. Once we're finished, we'll merge the code change to the master branch.

Just for clarification: does the whole LogicApp fail, meaning you're not seeing any data since August 23rd in your Log Analytics workspace, or does it only show a failure in the Logic App's run history?

[famjunxiang]

Hi @TomJanetscheck , thanks for your respond. yes the whole LogicApp fail, and not seeing any data since August 23rd.
Thanks.

[TomJanetscheck]

@famjunxiang - you can either deploy the Get-SecureScoreData LogicApp from the latest version, or you go ahead and update the existing LogicApp in your environment. If you choose to update your existing artifact, please make sure to incorporate the following code as it was added in PR #205

,
{
"equals": [
"@items('For_each')?['state']",
"Enabled"
]
}

The code needs to be added after the check for a subscription's registration state, you can refer to the PR to see what's been changed and where to add it in your LogicApp code.

Closing this issue as a solution was provided.

[famjunxiang]

Hi @TomJanetscheck , the logic app run well between 1 - 3 September 2020, and since 4th September, it failed again with below error at HTTP2, after checking, i unable to locate any subscription in my tenant end with 80af. Thanks.
{
"Error": {
"Code": "ResourceNotFound",
"Message": "Secure score 'ascScore' does not exist in scope 'xxxxxxxx-xxxx-xxxx-xxxx-6bdbcbe080af'"
}
}

[TomJanetscheck]

Hi @famjunxiang ,
The Logic App leverages the Secure Scores API in a For Each loop. The subscription ID is parsed from the output of a GET command against the subscriptions API. If the subscription ID you mention above is used in HTTP2, the respective subscription is in the Logic App's Managed Identity's read scope. You can test the API connection including the results that come back from the Get command yourself when you klick the link above. In the documentation, you will find a Try it button. Once you click that button, you are asked to authenticate. Please use an account with the same access rights as the Logic App's Managed Identity.